Rapid7 Metasploit Framework up to 4.13.0 extapi Clipboard.parse_dump path traversal

Summaryinfo

A vulnerability identified as critical has been detected in Rapid7 Metasploit Framework up to 4.13.0. The affected element is the function Clipboard.parse_dump of the component extapi. This manipulation causes path traversal. This vulnerability is tracked as CVE-2017-5229. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Rapid7 Metasploit Framework up to 4.13.0. It has been declared as critical. Affected by this vulnerability is the function Clipboard.parse_dump of the component extapi. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter extapi Clipboard.parse_dump() function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance.

The bug was discovered 03/02/2017. The weakness was disclosed 03/02/2017 with NCC Group (Website). The advisory is shared at community.rapid7.com. This vulnerability is known as CVE-2017-5229 since 01/09/2017. The attack can be launched remotely. A single authentication is required for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading to version 4.13.0-2017020701 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 96954†). The entries VDB-97476, VDB-97478, VDB-97479 and VDB-97480 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Rapid7

Name

• Metasploit Framework

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13.0

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion